@zerohash-sdk/fund-withdrawals-react
A React SDK for embedding the Zerohash Fund Withdrawals flow into web applications. Lets users withdraw assets from their Fund account to an external destination.
This report shows the evidence for @zerohash-sdk/fund-withdrawals-react@0.14.13. 0 of 21 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 5d ago · by lpm-firewall-aiThe package’s normal purpose is to load Zerohash’s hosted withdrawal widget, but load failures also trigger an undocumented report containing JWT claims and browser context. The collector is Zerohash-affiliated and the source does not send the raw JWT, so this is suspicious runtime telemetry rather than a clear credential theft attack.
Decision evidence
public snapshot- On widget load failure, the package sends diagnostics to Zerohash Grafana Faro collector endpoints.
- The diagnostic payload includes participant, platform and region claims decoded from the supplied JWT.
- The payload includes the browser user agent, page origin and failed script details.
- The report is sent as a JSON POST; the component loader wires reporting into its error path.
- The package is a React wrapper for Zerohash’s fund-withdrawals flow and loads its hosted widget.
- The diagnostic code sends selected JWT claims, not the raw JWT.
- The package manifest has no lifecycle scripts.
Source & flagged code
5 flaggedOn widget load failure, the package sends diagnostics to Zerohash Grafana Faro collector endpoints.
dist/index.jsView on unpkg · L5The diagnostic payload includes participant, platform and region claims decoded from the supplied JWT.
dist/index.jsView on unpkg · L41Findings
Affected versions and remediation
This report applies to @zerohash-sdk/fund-withdrawals-react@0.14.13.
The versions list below shows the verdict for each recorded version.
- Review the evidence and your use of @zerohash-sdk/fund-withdrawals-react@0.14.13 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.